#NØØT_Security_Alerts 🚨 #ALERT — CRITICAL MARKLOGIC XQUERY INJECTION ENABLES PERSISTENT UNAUTHORIZED ADMINISTRATIVE CONTROL October 12, 2026 DISCLOSED BY: Progress Software PRODUCT: MarkLogic Server CVE: CVE-2026-85948 SEVERITY: CRITICAL — CVSS 9.9 AFFECTED VERSIONS: 11.0.0 through versions before 11.3.7. 12.0.0 through versions before 12.1.0. IMPACT: An XQuery injection vulnerability in a deprecated Management API package path permits attackers with manage-user-level privileges to obtain persistent unauthorized administrative control. EXPOSURE: Requires existing manage-user-level privileges and network access to affected management functionality. No evidence establishes an unauthenticated exploitation path. EXPLOITATION STATUS: VENDOR-CONFIRMED CRITICAL PRIVILEGE ESCALATION. No confirmed malicious exploitation in the wild or independently verified working public PoC. Forensic triage: Review Management API activity, unexpected XQuery execution, privilege modifications and unauthorized administrator-account changes. Investigate suspicious use of deprecated management functionality and unexplained database configuration changes. No verified campaign-specific IOCs have been published. URGENT ACTION: Upgrade MarkLogic 11.x to 11.3.7 or later and 12.x to 12.1.0 or later. Restrict management API exposure, enforce least privilege and audit all accounts with manage-user permissions. Investigate evidence of unauthorized administrative access before restoring affected environments. SOURCE: https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026 OFFICIAL CVE: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85948.json CONFIDENCE: HIGH — Progress-authored CVE record confirms the vulnerability, exploitation prerequisites and affected releases. Real-world exploitation remains unverified. #CyberSecurity #ThreatIntel #MarkLogic #XQuery #PrivilegeEscalation #DatabaseSecurity